https://unclet67.github.io/cyber-threat-dashboard/ China / Russia / Iran / North Korea cyber and information-warfare reporting, collected hourly from 27 vetted feeds. https://www.proofpoint.com/us/blog/threat-insight/unpacking-cruciferra-analysis-sophisticated-crypter-service https://www.proofpoint.com/us/blog/threat-insight/unpacking-cruciferra-analysis-sophisticated-crypter-service Mon, 20 Jul 2026 20:10:28 GMT CN Proofpoint Threat Insight Key Findings  Cruciferra is a sophisticated crypter service used by multiple unrelated cybercriminal threat clusters.   It has been observed delivering a wide range of remote access trojans and infostealers.  The malware employs extensive defense-evasion capabilities and over 90 variations of cryptographic functions to obfuscate its data and payloads.  Proofpoint identified both production and apparent testing variants, indicating the service is under active development. https://www.helpnetsecurity.com/2026/07/20/hollowgraph-malware-microsoft-365-calendar/ https://www.helpnetsecurity.com/2026/07/20/hollowgraph-malware-microsoft-365-calendar/ Mon, 20 Jul 2026 17:20:15 GMT IR Help Net Security Microsoft 365 calendars have become a hiding place for espionage malware, with commands and stolen files stashed inside appointments dated to the year 2050, researchers from Group-IB discovered. Targeted campaign tied to Iranian espionage activity The malware, which Group-IB calls HOLLOWGRAPH, is one component of a bigger toolkit the company links with high confidence to the Cavern backdoor framework, a modular espionage toolkit built from separate plugins that each handle a different task, prev https://thehackernews.com/2026/07/russian-intelligence-hacks-ip-cameras.html https://thehackernews.com/2026/07/russian-intelligence-hacks-ip-cameras.html Mon, 20 Jul 2026 12:13:39 GMT RU The Hacker News At least one Russian intelligence service is systematically hijacking internet-connected security cameras across Europe and Ukraine, using the feeds to watch military transport routes, weapons shipments bound for Kyiv, and the locations of Ukrainian troops. That is the finding of a cybersecurity advisory published July 10 by the AIVD and MIVD, the Netherlands' civilian and military intelligence https://thehackernews.com/2026/07/russian-speaking-hacker-uses-google.html https://thehackernews.com/2026/07/russian-speaking-hacker-uses-google.html Mon, 20 Jul 2026 09:07:11 GMT RU The Hacker News A solo Russian-speaking threat actor known as "bandcampro" outsourced a chunk of their operations to Google's open-source Gemini CLI artificial intelligence (AI) and commandeered a live botnet. The findings come from an analysis of 200 Gemini CLI session logs between March 19 and April 21, 2026, which found the threat actor using AI, among other things, to crack passwords, set up a residential https://www.bleepingcomputer.com/news/security/hackers-abuse-vipnet-software-to-target-russian-govt-agencies/ https://www.bleepingcomputer.com/news/security/hackers-abuse-vipnet-software-to-target-russian-govt-agencies/ Sun, 19 Jul 2026 14:23:46 GMT RU BleepingComputer An advanced threat actor is abusing the update mechanism for the ViPNet private networking product suite to target Russian organizations, including government agencies. [...] https://thehackernews.com/2026/07/uac-0145-uses-clickfix-captchas-to.html https://thehackernews.com/2026/07/uac-0145-uses-clickfix-captchas-to.html Sun, 19 Jul 2026 13:30:55 GMT RU The Hacker News Russian state-sponsored threat actors have been observed leveraging the infamous ClickFix strategy to trick Ukrainian targets into infecting their own machines with data-stealing malware. According to the Computer Emergency Response Team of Ukraine (CERT-UA), the activity has been attributed to UAC-0145, a sub-cluster within Sandworm, an advanced hacking unit affiliated with GRU, Russia's https://www.wired.com/story/security-news-this-week-your-period-tracker-is-probably-spying-on-you/ https://www.wired.com/story/security-news-this-week-your-period-tracker-is-probably-spying-on-you/ Sat, 18 Jul 2026 10:30:00 GMT RU WIRED — Security Plus: Russian cyberspies turn to infrastructure hacking, DHS repeatedly fails to realize it’d been hacked, a breach exposes an AI music generator’s scraping ways, and more. https://thehackernews.com/2026/07/goldeneyedog-subgroup-linked-to.html https://thehackernews.com/2026/07/goldeneyedog-subgroup-linked-to.html Fri, 17 Jul 2026 16:39:16 GMT CN The Hacker News Cybersecurity researchers have attributed the April 2026 DigiCert security incident to a threat activity cluster dubbed CylindricalCanine. Expel, which shared technical details of the event, described the threat actor as a sub-group of GoldenEyeDog (aka APT-Q-27, Dragon Breath, and Miuuti Group), a Chinese cybercrime group known for its targeting of the gambling and gaming sectors using https://thehackernews.com/2026/07/north-korea-linked-hackers-hide.html https://thehackernews.com/2026/07/north-korea-linked-hackers-hide.html Fri, 17 Jul 2026 13:48:56 GMT KP The Hacker News North Korean threat actors linked to the Contagious Interview campaign have been observed employing steganography in SVG image files to conceal malicious payloads as part of a campaign using fake job postings and coding challenges. "Any user who ran the project ended up with a four-stage payload aligned with OtterCookie: a browser credential and crypto wallet stealer, a file stealer, a https://thehackernews.com/2026/07/armenia-detains-russian-tourist-on-us.html https://thehackernews.com/2026/07/armenia-detains-russian-tourist-on-us.html Fri, 17 Jul 2026 10:53:31 GMT RU The Hacker News Armenia has held a Russian tourist named Aleksandr Ermakov in a detention center since June 28, on a U.S. extradition request for a REvil ransomware suspect named Aleksandr Ermakov. His wife, Maria Yurova, told REN TV that border officers pulled him out of the departure hall at Yerevan's Zvartnots airport, held up a phone with a photo of him off his VKontakte page, and walked him into a side https://thehackernews.com/2026/07/daxin-resurfaces-in-taiwan-alongside.html https://thehackernews.com/2026/07/daxin-resurfaces-in-taiwan-alongside.html Thu, 16 Jul 2026 11:17:23 GMT CN The Hacker News An advanced malware previously attributed to a China-linked threat actor has resurfaced after more than four years within a Taiwan manufacturing firm, along with a previously unreported backdoor dubbed Stupig. Daxin ("srt64.sys"), as the kernel-mode rootkit is referred to, was first documented by Broadcom-owned Symantec in March 2022, with evidence indicating its use in targeted attacks aimed https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/ https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/ Thu, 16 Jul 2026 10:00:01 GMT RU Cisco Talos Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025. https://www.theregister.com/research/2026/07/14/the-bots-are-alive-jailbroken-gemini-spun-up-new-c2-server-for-russian-fraudster-in-just-6-minutes/5270131 https://www.theregister.com/research/2026/07/14/the-bots-are-alive-jailbroken-gemini-spun-up-new-c2-server-for-russian-fraudster-in-just-6-minutes/5270131 Tue, 14 Jul 2026 12:15:00 GMT RU The Register — Security Human did 10% of the job, AI did 90% https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a Mon, 13 Jul 2026 12:00:00 GMT CN CISA Advisories Russian Government-Sponsored Activity Targets Poorly Configured and Vulnerable Devices Across Critical Sectors Executive summary Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks. This joint Cybersecurity Advisory (CSA) builds on FBI’s Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure Pub https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a Mon, 13 Jul 2026 12:00:00 GMT RU CISA Advisories Russian Government-Sponsored Activity Targets Poorly Configured and Vulnerable Devices Across Critical Sectors Executive summary Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks. This joint Cybersecurity Advisory (CSA) builds on FBI’s Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure Pub https://www.ncsc.gov.uk/news/uk-and-allies-urge-critical-sectors-to-improve-defences-against-russian-intelligence-targeting https://www.ncsc.gov.uk/news/uk-and-allies-urge-critical-sectors-to-improve-defences-against-russian-intelligence-targeting Mon, 13 Jul 2026 12:00:00 GMT RU NCSC UK New advisory highlights Russian state cyber actors’ global exploitation of poorly configured routers https://www.darkreading.com/cyber-risk/iran-cyber-crosshairs-beyond-critical-infrastructure https://www.darkreading.com/cyber-risk/iran-cyber-crosshairs-beyond-critical-infrastructure Thu, 09 Jul 2026 20:32:00 GMT IR Dark Reading Obscurity isn't a defense. If your company has any Internet-facing vulnerability, you're at risk from multiple threats. https://www.theregister.com/security/2026/07/08/china-ditch-older-claude-versions-with-backdoor-code/5268371 https://www.theregister.com/security/2026/07/08/china-ditch-older-claude-versions-with-backdoor-code/5268371 Wed, 08 Jul 2026 13:58:07 GMT CN The Register — Security National vulnerability database claims monitoring mechanism can forward Chinese users' data to remote servers https://www.wired.com/story/what-happens-if-china-hacks-the-us-water-supply-war-game-volt-typhoon/ https://www.wired.com/story/what-happens-if-china-hacks-the-us-water-supply-war-game-volt-typhoon/ Wed, 08 Jul 2026 10:00:00 GMT CN WIRED — Security Burst water mains. Evacuated hospitals. In a closed-door simulation, insurers played out their response to a mass disruption by China’s Volt Typhoon hackers—and found a nightmare scenario. https://www.proofpoint.com/us/blog/threat-insight/one-email-closer-edge-unkmasstraction-physics-exploitation https://www.proofpoint.com/us/blog/threat-insight/one-email-closer-edge-unkmasstraction-physics-exploitation Tue, 07 Jul 2026 15:47:12 GMT CN Proofpoint Threat Insight Analyst note: Proofpoint uses the UNK_ designator to define clusters of activity that are still developing and have not been observed for long enough to receive a numerical TA designation. Key Findings Since May 2026, Proofpoint Threat Research has been tracking a suspected China-aligned threat cluster named UNK_MassTraction exploiting Roundcube mailservers belonging to the physics and engineering departments of US and Canadian universities. The campaigns exploit multiple n-day vulnerabilities i https://www.theregister.com/security/2026/07/07/alleged-pro-russia-hacktivist-arrested-in-palencia/5267569 https://www.theregister.com/security/2026/07/07/alleged-pro-russia-hacktivist-arrested-in-palencia/5267569 Tue, 07 Jul 2026 10:30:50 GMT RU The Register — Security Palencia man suspected of links to CARR, Z-Pentest, and NoName057(16), plus helping a Ukrainian hacker flee to Russia https://research.checkpoint.com/2026/cavern-manticore-exposing-iran-linked-modular-c2-framework/ https://research.checkpoint.com/2026/cavern-manticore-exposing-iran-linked-modular-c2-framework/ Mon, 06 Jul 2026 12:25:02 GMT IR Check Point Research Key Points Introduction Since early 2026, Check Point Research (CPR) has tracked a new modular command-and-control framework used by Cavern Manticore, an Iran-nexus APT group primarily targeting Israeli organizations, with a focus on IT providers, and government sectors. Cavern Manticore is an Iran MOIS (Ministry of Intelligence and Security)-linked actor, with links to the OilRig […] The post Cavern Manticore: Exposing Iran-Linked Modular C2 Framework appeared first on Check Point Research . https://securelist.com/tr/armored-likho-apt-with-busysnake-stealer/120292/ https://securelist.com/tr/armored-likho-apt-with-busysnake-stealer/120292/ Fri, 03 Jul 2026 10:00:33 GMT RU Kaspersky Securelist An inside look at the active Armored Likho APT campaign. The attackers are using spear-phishing, AI-generated loaders, and a new Python-based tool, BusySnake Stealer, to target organizations in Russia, Kazakhstan, and Brazil. https://www.welivesecurity.com/en/eset-research/gamaredon-2025-leveraging-tunnels-workers-dead-drops-new-alliances/ https://www.welivesecurity.com/en/eset-research/gamaredon-2025-leveraging-tunnels-workers-dead-drops-new-alliances/ Thu, 25 Jun 2026 08:45:00 GMT RU ESET WeLiveSecurity ESET Research analyzes Gamaredon’s new toolset and the group’s growing reliance on legitimate online services to hide its C&C infrastructure and exfiltrate stolen data https://www.proofpoint.com/us/blog/threat-insight/sayonara-socgholish-operation-endgame-disrupts-major-cybercrime-operation https://www.proofpoint.com/us/blog/threat-insight/sayonara-socgholish-operation-endgame-disrupts-major-cybercrime-operation Wed, 17 Jun 2026 17:59:58 GMT RU Proofpoint Threat Insight Key Findings  Global law enforcement and private sector partners worked to disrupt activity related to TA569, as part of Operation Endgame.  TA569 is one of the most prominent cybercriminal threat groups in Proofpoint threat data, which our researchers have tracked since 2018.   TA569’s SocGholish inject activity has been linked to major ransomware families and criminal syndicates.  The law enforcement actions included disrupting their serve https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal Mon, 08 Jun 2026 15:11:53 GMT KP Proofpoint Threat Insight By Saher Naumaan, Carlos Rubio, and the Proofpoint Threat Research Team Key Findings Between April and May 2026, Proofpoint Threat Research observed a likely North Korean threat actor conducting phishing campaigns using developer role recruitment or code review themes to targets in close to 100 organizations in finance, cryptocurrency, education, technology, and several other sectors. Proofpoint clusters this activity under the name UNK_DeadDrop. The infection chain begins with emails containing https://www.proofpoint.com/us/blog/threat-insight/ta4922-suspected-chinese-crime-group-going-global https://www.proofpoint.com/us/blog/threat-insight/ta4922-suspected-chinese-crime-group-going-global Wed, 03 Jun 2026 17:06:32 GMT CN Proofpoint Threat Insight Key Findings:  TA4922 is a highly sophisticated threat actor demonstrating a rapid operational tempo and continually evolving malware arsenal.  The group has been observed using multiple malware families including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0), among others.  TA4922 relies on localized lures often themed around HR, payroll, tax, and invoicing to convince targets across multiple regions. In recent months, https://www.proofpoint.com/us/blog/threat-insight/more-cves-same-playbook-2026-vulnerability-exploitation-wild https://www.proofpoint.com/us/blog/threat-insight/more-cves-same-playbook-2026-vulnerability-exploitation-wild Wed, 27 May 2026 15:00:00 GMT RU Proofpoint Threat Insight Executive Summary The CVE Landscape Has Changed. The Threat Actors Haven't.  Proofpoint's dual telemetry streams — targeted attack visibility covering hundreds of millions of messages daily, and a global network sensor array that generated over 3 million alerts and identified four undisclosed CVEs in 2026 to date — present a consistent picture: attackers are opportunistic. They grab newly published CVEs when public proof-of-concept code appears, chain them https://www.proofpoint.com/us/blog/threat-insight/more-cves-same-playbook-2026-vulnerability-exploitation-wild https://www.proofpoint.com/us/blog/threat-insight/more-cves-same-playbook-2026-vulnerability-exploitation-wild Wed, 27 May 2026 15:00:00 GMT KP Proofpoint Threat Insight Executive Summary The CVE Landscape Has Changed. The Threat Actors Haven't.  Proofpoint's dual telemetry streams — targeted attack visibility covering hundreds of millions of messages daily, and a global network sensor array that generated over 3 million alerts and identified four undisclosed CVEs in 2026 to date — present a consistent picture: attackers are opportunistic. They grab newly published CVEs when public proof-of-concept code appears, chain them https://krebsonsecurity.com/2026/05/netherlands-seizes-800-servers-arrests-2-for-aiding-cyberattacks/ https://krebsonsecurity.com/2026/05/netherlands-seizes-800-servers-arrests-2-for-aiding-cyberattacks/ Mon, 25 May 2026 13:21:49 GMT RU Krebs on Security Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two men were the focus of a 2025 KrebsOnSecurity story about how their hosting companies had assumed control over the technical infrastructure of Stark Industries Solutions, an Internet service provider sanctioned last year by the EU as a frequ https://www.welivesecurity.com/en/videos/month-security-tony-anscombe-april-2026/ https://www.welivesecurity.com/en/videos/month-security-tony-anscombe-april-2026/ Thu, 30 Apr 2026 09:00:00 GMT IR ESET WeLiveSecurity Warnings about helpdesk impersonation scams and Iran-linked hackers targeting critical sectors in the US, plus the most damaging scams of 2025 - here's some of what made the headlines this month https://www.ncsc.gov.uk/news/executive-summary-defending-against-china-nexus-covert-networks-of-compromised-devices https://www.ncsc.gov.uk/news/executive-summary-defending-against-china-nexus-covert-networks-of-compromised-devices Thu, 23 Apr 2026 12:00:00 GMT CN NCSC UK Organisations should map and baseline their edge device traffic, especially VPN and remote access connections, and adopt dynamic threat feed filtering that includes known covert network indicators. https://www.ncsc.gov.uk/news/international-cyber-agencies-fresh-advice-defend-against-china-linked-covert-networks https://www.ncsc.gov.uk/news/international-cyber-agencies-fresh-advice-defend-against-china-linked-covert-networks Thu, 23 Apr 2026 12:00:00 GMT CN NCSC UK New advisory highlights how to defend against attacker tactics believed to be used by China-linked actors to hide malicious cyber activity. https://www.welivesecurity.com/en/eset-research/gopherwhisper-burrow-full-malware/ https://www.welivesecurity.com/en/eset-research/gopherwhisper-burrow-full-malware/ Thu, 23 Apr 2026 08:59:18 GMT CN ESET WeLiveSecurity ESET Research has discovered a new China-aligned APT group that we’ve named GopherWhisper, which targets Mongolian governmental institutions